Documentation Grafana Cloud Instrument and send data Grafana Alloy Reference Components otelcol otelcol.receiver.syslog

otelcol.receiver.syslog

Public preview: This is a public preview component. Public preview components are subject to breaking changes, and may be replaced with equivalent functionality that cover the same use case. To enable and use a public preview component, you must set the stability.level flag to public-preview or below.

otelcol.receiver.syslog accepts syslog messages over the network and forwards them as logs to other otelcol.* components. It supports syslog protocols RFC5424 and RFC3164 and can receive data over TCP or UDP.

You can specify multiple otelcol.receiver.syslog components by giving them different labels.

Usage

alloy Copy

otelcol.receiver.syslog "<LABEL>" {
  tcp { ... }
  udp { ... }

  output {
    logs    = [...]
  }
}

Arguments

You can use the following arguments with otelcol.receiver.syslog:

The protocol argument specifies the syslog format supported by the receiver. protocol must be one of rfc5424 or rfc3164

The location argument specifies a Time Zone identifier. The available locations depend on the local IANA Time Zone database. Refer to the list of tz database time zones in Wikipedia for a non-comprehensive list.

The non_transparent_framing_trailer and enable_octet_counting arguments specify TCP syslog behavior as defined in RFC6587. These arguments are mutually exclusive. They can’t be used with a UDP syslog listener configured. If configured, the non_transparent_framing_trailer argument must be one of LF, NUL.

The on_error argument can take the following values:

• drop: Drop the message.
• drop_quiet: Same as drop but logs are emitted at debug level.
• send: Send the message even if it failed to process. This may result in an error downstream.
• send_quiet: Same as send but logs are emitted at debug level.

Blocks

You can use the following blocks with otelcol.receiver.syslog:

The > symbol indicates deeper levels of nesting. For example, tcp > tls refers to a tls block defined inside a tcp block.

A syslog receiver must have either a udp or tcp block configured.

output

Required

The output block configures a set of components to forward resulting telemetry data to.

The following arguments are supported:

You must specify the output block, but all its arguments are optional. By default, telemetry data is dropped. Configure the metrics, logs, and traces arguments accordingly to send telemetry data to other components.

debug_metrics

The debug_metrics block configures the metrics that this component generates to monitor its state.

The following arguments are supported:

disable_high_cardinality_metrics is the Alloy equivalent to the telemetry.disableHighCardinalityMetrics feature gate in the OpenTelemetry Collector. It removes attributes that could cause high cardinality metrics. For example, attributes with IP addresses and port numbers in metrics about HTTP and gRPC connections are removed.

retry_on_failure

The retry_on_failure block configures the retry behavior when the receiver encounters an error downstream in the pipeline. A backoff algorithm is used to delay the retry upon subsequent failures. The following arguments are supported:

If max_elapsed_time is set to 0, data will never be discarded.

tcp

The tcp block configures a TCP syslog server. The following arguments are supported:

The encoding argument specifies the encoding of the incoming syslog messages. encoding must be one of utf-8, utf-16le, utf-16be, ascii, big5, nop. Refer to the upstream receiver documentation for more details.

The max_log_size argument has a minimum value of 64KiB

multiline

The multiline block configures logic for splitting incoming log entries. The following arguments are supported:

A multiline block must contain either line_start_pattern or line_end_pattern.

If a multiline block isn’t set, log entries won’t be split.

tls

The tls block configures TLS settings used for a server. If the tls block isn’t provided, TLS won’t be used for connections to the server.

The following arguments are supported:

If reload_interval is set to "0s", the certificate never reloaded.

The following pairs of arguments are mutually exclusive and can’t both be set simultaneously:

• ca_pem and ca_file
• cert_pem and cert_file
• key_pem and key_file

If cipher_suites is left blank, a safe default list is used. Refer to the Go Cipher Suites documentation for a list of supported cipher suites.

client_ca_file sets the ClientCA and ClientAuth to RequireAndVerifyClientCert in the TLSConfig. Refer to the Go TLS documentation for more information.

The curve_preferences argument determines the set of elliptic curves to prefer during a handshake in preference order. If not provided, a default list is used. The set of elliptic curves available are X25519, P521, P256, and P384.

udp

The udp block configures a UDP syslog server. The following arguments are supported:

The encoding argument specifies the encoding of the incoming syslog messages. encoding must be one of utf-8, utf-16le, utf-16be, ascii, big5, or nop. Refer to the upstream receiver documentation for more details.

async

The async block configures concurrent asynchronous readers for a UDP syslog server. The following arguments are supported:

If async isn’t set, a single goroutine will read and process messages synchronously.

Exported fields

otelcol.receiver.syslog doesn’t export any fields.

Component health

otelcol.receiver.syslog is only reported as unhealthy if given an invalid configuration.

Debug information

otelcol.receiver.syslog doesn’t expose any component-specific debug information.

Debug metrics

otelcol.receiver.syslog doesn’t expose any component-specific debug metrics.

Example

This example proxies syslog messages from the otelcol.receiver.syslog receiver to the otelcol.exporter.syslog component, and then sends them on to a loki.source.syslog component before being logged by a loki.echo component. This shows how the otelcol syslog components can be used to proxy syslog messages before sending them to another destination.

Using the otelcol syslog components in this way results in the messages being forwarded as sent, attempting to use the loki.source.syslog component for a similar proxy use case requires careful mapping of any structured data fields through the otelcol.processor.transform component. A very simple example of that can be found in the otelcol.exporter.syslog documentation.

alloy Copy

otelcol.receiver.syslog "default" {
    protocol = "rfc5424"
    tcp {
        listen_address = "localhost:1515"
    }
    output {
        logs = [otelcol.exporter.syslog.default.input]
    }
}

otelcol.exporter.syslog "default" {
    endpoint = "localhost"
    network = "tcp"
    port = 1514
    protocol = "rfc5424"
    enable_octet_counting = false
    tls {
        insecure = true
    }
}

loki.source.syslog "default" {
  listener {
    address = "localhost:1514"
    protocol = "tcp"
    syslog_format = "rfc5424"
    label_structured_data = true
    use_rfc5424_message = true
  }
  forward_to = [loki.echo.default.receiver]
}

loki.echo "default" {}

Compatible components

otelcol.receiver.syslog can accept arguments from the following components:

• Components that export OpenTelemetry otelcol.Consumer